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ICO consultation on the draft updated data sharing 
code of practice 


Data sharing brings important benefits to organisations and individuals, 
making our lives easier and helping to deliver efficient services. 


It is important, however, that organisations which share personal data 
have high data protection standards, sharing data in ways that are fair, 
transparent and accountable. We also want organisations to be confident 
when dealing with data sharing matters, so individuals can be confident 
their data has been shared securely and responsibly. 


As required by the Data Protection Act 2018, we are working on updating 
our data sharing code of practice, which was published in 2011. We are 
now seeking your views on the draft updated code. 


The draft updated code explains and advises on changes to data 
protection legislation where these changes are relevant to data sharing. It 
addresses many aspects of the new legislation including transparency, 
lawful bases for processing, the new accountability principle and the 
requirement to record processing activities. 


The draft updated code continues to provide practical guidance in relation 
to data sharing and promotes good practice in the sharing of personal 
data. It also seeks to allay common concerns around data sharing. 


As well as legislative changes, the code deals with technical and other 
developments that have had an impact on data sharing since the 
publication of the last code in 2011. 


Before drafting the code, the Information Commissioner launched a call 
for views in August 2018. You can view a summary of the responses and 
some of the individual responses here. 


If you wish to make any comments not covered by the questions in the 
survey, or you have any general queries about the consultation, please 


email us at datasharingcode@ico.org.uk. 


Please send us your responses by Monday 9 September 2019. 


Privacy Statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
Capacity (e.g. a member of the public). All responses from organisations 
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and individuals responding in a professional capacity will be published. We 
will remove email addresses and telephone numbers from these 
responses; but apart from this, we will publish them in full. 


For more information about what we do with personal data please see our 
privacy notice. 


Questions 


Note: when commenting, please bear in mind that, on the whole, the 
code does not duplicate the content of existing guidance on particular 
data protection issues, but instead encourages the reader to refer to the 
most up to date guidance on the ICO website. 


Q1 Does the updated code adequately explain and advise on the new 
aspects of data protection legislation which are relevant to data 
sharing? 


O Yes 


O No 


Q2 If not, please specify where improvements could be made. 


As a movement of patients, relatives and carers, we recognise that we 
are clearly not the primary audience for this document. 


Q3 Does the draft code cover the right issues about data sharing? 
O Yes 


xX] No 
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Q4 ___siIf no, what other issues would you like to be covered in it? 


Given the need for increased levels of transparency as a means to 
improve public/patient trust in how their data is used, we have 
approached this from the perspective of a patient wanting to 
understand more about how their data is protected and used. 


Are there any plans to produce something like this, but with a specific 
patient focus? Given that all data controllers have to produce 
information for patients, would it not be sensible to produce some 
central guidance in this area? 


Q5 Does the draft code contain the right level of detail? 
Ll Yes 


Xx] No 


Q6__—siIf. no, in what areas should there be more detail within the draft 
code? 


Sometimes less is more. Whilst we recognise the need for 
completeness in this complex area, there may be a benefit in a more 
navigable route through this complexity. 


So whilst the draft appears to be comprehensive, and all the information 
appears to be in there, it might prove difficult in practical use. 


Have you considered some form of flowchart or decision-tree which 
could allow organisations to navigate to the areas which are relevant to 
them? 


This might also be useful for a patient audience. 


Q7 Has the draft code sufficiently addressed new areas or 
developments in data protection that are having an impact on your 
organisation’s data sharing practices? 


O Yes 
O No 
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Q8 If no, please specify what areas are not being addressed, or not 
being addressed in enough detail 


Q9 Does the draft code provide enough clarity on good practice in data 
sharing? 


L] Yes 


Xx] No 


Q10 If no, please indicate the section(s) of the draft code which could be 
improved, and what can be done to make the section(s) clearer. 


From a patient perspective, the area of uses of anonymised or 
pseudonymised data remains confusing. 


Whilst truly anonymous data can be put in the public domain, 
understanding what use is made of our de-identified data (by this we 
mean anonymised or pseudonymised) remains much less clear. 


We would have hoped for clarity around how our de-identified health 
data can be used where the National Data Opt-out does not apply. We 
are aware that websites exist, produced by privacy groups, which show 
that organisations have received de-identified health data which 
includes data on patients who have requested to be included in the 
National Data Opt-out. This is breeding confusion and mistrust. 


Finally, on the topic of the word “sold”, we would like the ICO to be 
much clearer about whether cost-recovery should be regarded as 
“selling data” or not. 
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Q11 Does the draft code strike the right balance between recognising 
the benefits of sharing data and the need to protect it? 


O Yes 


x] No 


Q1i2_~_siIf no, in what way does the draft code fail to strike this balance? 


The focus of the Guide appears to be about the mechanistic and 
procedural elements of sharing data, rather than on the benefits which 
may be accrued. 


We would also highlight that there are potential harms which could 
occur if data is NOT shared. This factor is mentioned briefly only twice 
in the document but should also be taken into account and given a more 
prominent emphasis. 


Q13 Does the draft code cover case studies or data sharing scenarios 
relevant to your organisation? 


O Yes 


x] No 


Q14 Please provide any further comments or suggestions you may have 
about the draft code. 
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Q15 To what extent do you agree that the draft code is clear and easy 
to understand? 


Strongly agree 
O Agree 


X Neither agree nor disagree 


Disagree 


O Strongly disagree 


Q16 Are you answering as: 


O An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the public) 


O An individual acting in a professional capacity 


X On behalf of an organisation 


O Other 
Please specify the name of your organisation: 


use MY data - www.useMYdata.org.uk 


Please contact [ES if you have any queries 


about our response. 


Thank you for taking the time to share your views and experience. 


